NSA MCP Hardening Guidelines: What the Official Guidance Means for MCP Server Developers

The NSA released official hardening guidelines for Model Context Protocol deployments in July 2026 — the first time a major government security agency has issued formal guidance on AI agent infrastructure. The document is aimed at organizations running MCP in production, but it contains specific recommendations that matter for anyone building or deploying MCP servers. Here's what it covers.

Why the NSA issued MCP guidance

MCP is infrastructure. It connects AI agents to internal tools, databases, APIs, and sensitive business systems. As enterprise adoption accelerated in 2025 and 2026, MCP servers started appearing in the same threat model as internal APIs and database connectors — systems that hold or grant access to sensitive data and that, if compromised, can have significant consequences.

The NSA guidance comes after a pattern of incidents: poisoned MCP server configurations in developer tools, malicious listings in MCP registries, unauthenticated MCP endpoints exposed on public networks, and the discovery of auto-execution vulnerabilities in tools like Amazon Q that could be triggered through MCP tool responses. The guidance is a response to these incidents becoming a recognized category of threat.

The core recommendations

The NSA guidance groups recommendations into four areas:

1. Authentication and access control

Every MCP server that handles non-public data or has side effects must require authentication. The guidance specifically calls out unauthenticated remote MCP servers as a critical finding — they represent a complete absence of access control on a system that may have significant capabilities.

The recommended approach aligns with EMA (Enterprise-Managed Authorization) from the MCP 2026-07-28 spec: centralize auth through the organization's identity provider rather than implementing per-server credential management. For organizations not yet on EMA, API keys with short rotation cycles and tight scope restrictions are the acceptable interim approach.

The guidance also recommends least-privilege scoping: each MCP server should expose only the specific capabilities it needs, and each user or agent identity should be granted only the scopes required for their legitimate use case. A documentation query tool should not be able to write to a database, and an agent performing read-only analysis should not have tool access that enables writes.

2. Input validation and prompt injection hardening

This is the section most relevant to MCP server developers. The NSA guidance calls prompt injection through tool output a "tier 1" risk — the highest severity category — because it can cause an agent to take unintended actions against authenticated systems without the user being aware.

Specific guidance for server developers:

• Never return raw external content verbatim in tool responses. Content from web pages, documents, emails, or any external source should be processed before being returned — summarized, chunked through an embedding pipeline, or at minimum stripped of markup and obvious injection patterns.
• Tool descriptions must not contain instructions directed at the agent. The description field should describe what the tool does, not tell the agent how to behave. Descriptions that reference other tools, suggest calling sequences, or modify agent behavior are flagged as suspicious.
• Validate and sanitize tool input arguments even from trusted clients. Argument values should be checked against expected types, ranges, and formats before being used in downstream operations.

3. Network security and exposure

Remote MCP servers should not be exposed on public networks unless they are genuinely intended for public use. Internal MCP servers — those that access internal systems, private APIs, or organizational data — should be on internal networks with appropriate perimeter controls.

For servers that must be publicly reachable, the guidance recommends rate limiting per-identity (not just per-IP), request logging with sufficient detail to detect anomalous patterns, and regular review of which external systems the server can reach.

The guidance also addresses MCP server-to-server communication: when one MCP server calls another (in chained agent configurations), the authentication chain must be maintained. A server receiving a forwarded request should not grant more access than the original identity is authorized for.

4. Registry and supply chain verification

Before connecting an agent to a third-party MCP server from a registry, organizations should verify:

• The server is operated by a known entity with a verifiable identity
• The tool descriptions are factual and do not contain injection attempts
• The server's network behavior (what it calls, what it returns) matches its stated purpose
• The server has an operational security contact and a disclosed incident response process

The guidance notes that registry listings are not trust signals by themselves — a server can be listed in an official registry and still have malicious or vulnerable behavior. The official MCP registry maintained by AAIF has a verification process, but it verifies identity and spec compliance, not security posture.

What this means for MCP server developers

The NSA guidance is advisory, not regulatory — it's not a compliance framework with enforcement teeth. But for enterprise customers evaluating MCP servers, the guidance will increasingly become a procurement checklist. Expect enterprise buyers to ask whether your MCP server follows NSA hardening guidelines, especially for servers that handle sensitive data.

The practical implications for server developers:

Publish a security page. Document your auth model, what data your server accesses, what it logs, and how to report security issues. Enterprise buyers need this to complete security reviews.

Implement EMA or API key auth before you need it. Customers that take the NSA guidance seriously will not connect unauthenticated MCP servers to their internal agents. If your server has no auth, you're excluding yourself from enterprise use cases.

Process external content before returning it. If your tool fetches anything from the internet, a database, or an API, run it through a processing step before returning it to the agent. This is both a security requirement and a quality improvement — raw HTML is poor tool output regardless of injection risk.

Keep tool descriptions clean. This costs nothing and eliminates a category of risk. Tool descriptions should be one to three sentences describing inputs, outputs, and the tool's purpose. Nothing else.

How AgentReady aligns with the guidance

AgentReady's current posture on the four areas:

Auth: The public MCP endpoint and directory are intentionally public — they query public web content and return indexed documentation. Private MCP endpoints with per-org authentication are on the roadmap for enterprise customers.

Prompt injection: Content returned by ask_site passes through a RAG pipeline — chunked, embedded, and retrieved by semantic similarity. Raw page content is not returned verbatim. Tool descriptions are factual and contain no agent-directed instructions.

Network: The MCP endpoint is on Vercel's edge network with rate limiting. Request logging captures tool name, domain queried, and response latency. Agent event telemetry feeds the analytics dashboard.

Registry: AgentReady is listed in the official AAIF-governed MCP registry with a verified GitHub identity and complete server.json metadata.